Market adoption of wireless LAN (WLAN) technology has exploded, as users from a wide range of backgrounds and vertical industries have brought this technology into their homes, offices, and increasingly into the public air space. This inflection point has highlighted not only the limitations of earlier-generation systems, but the changing role WLAN technology now plays in people's work and lifestyles, across the globe. Indeed, WLANs are rapidly changing from convenience networks to business-critical networks. Increasingly users are depending on WLANs to improve the timeliness and productivity of their communications and applications, and in doing so, require greater visibility, security, management, and performance from their network.
As enterprises and other entities increasingly rely on wireless networks, security of wireless network environments becomes a critical component to ensure the integrity of the enterprise's network environment against unauthorized access. Indeed, wireless networks pose security risks not typically encountered in wired computer networks, since any wireless client in the radio frequency (RF) coverage area of an access point can, without a physical connection, potentially gain access to the network, or at the very least capture data transmitted in wireless frames. In an 802.11 wireless network, prior art security mechanisms are implemented in a variety of manners. For example, the 802.11 protocol provides for shared-key authentication according to which a wireless client must possess a shared secret key in order to establish a wireless connection with an access point. In addition, as with wired networks, the wireless network infrastructure can operate in connection with application level security mechanisms, such as a RADIUS or other authentication server, to control access to network resources.
Various measures have been developed to protect against eavesdropping. For example, the Wired Equivalent Privacy (WEP) algorithm is used to protect wireless communications from eavesdropping by encrypting wireless traffic based on a shared private key. WEP seeks to establish similar protection to that offered by the wired network's physical security measures by encrypting data transmitted over the WLAN. Data encryption protects the vulnerable wireless link between clients and access points. Wi-Fi Protected Access (WPA) has also been developed to address the known security flaws associated with WEP.
In addition, VPN functionality offers another or additional method of securing wireless connections. A Virtual Private Network (VPN) is a known communication application that typically operates at Layer 3 and of the OSI Reference model. This mechanism is used to provide secure communication among clients that have established a connection to a VPN server, typically a physical element in such a network. Specifically, a VPN server provides both authentication of, and privacy for, communications between the VPN server and a user device, such as a wireless client device. A traditional application of a VPN server is to secure the communications between user devices that are outside an enterprise's facilities and the enterprise's network over the public internet or dial-up connections. A typical VPN server, after authenticating the communications from the user devices and removing any encryption applied to protect the privacy of those communications, forwards the communications onto the company's internal network, providing reasonable assurance of secure communications. When used to secure wireless networks, Virtual Private Networking (VPN) client software creates a secure connection between a mobile station and a VPN server. The VPN client residing on a mobile station encrypts all data passed between it and a VPN server, making it very difficult for data contained in intercepted wireless frames to be read.
Many VPN solutions, such as Layer 2 Tunneling Protocol (L2TP) and IPSec in tunnel mode, require the use of two client IP addresses, one for the “outer” encapsulating IP packet header and another for the encapsulated IP packet. In a typical deployment, a VPN client obtains an IP address from an ISP which is used for the “outer” IP address and a second IP address from the VPN Server (the “inner” IP address) which is the VPN client's IP address on the VPN protected network. When used to secure wireless communications between a mobile station and an access point that bridges wireless traffic, a mobile station is typically assigned an IP address using DHCP functionality. Conventionally, the inner and outer IP addresses for the client or mobile station are often identical in VPN deployments used to protect wireless networks. This has the undesirable effect of decreasing network security by exposing the inner IP addresses assigned to the mobile stations, as well as any network topology information that can be gleaned from the inner IP address or collection of IP addresses from other mobile stations.
In light of the foregoing, a need in the art exists for methods, apparatuses and systems that prevent eavesdroppers from obtaining access to internal network addresses assigned to mobile stations. Embodiments of the present invention substantially fulfill this need.